About Joycetran

Joycetran · ‎02-05-2020

I have the admin access. If I run manually in search head, It works. When i bring to service to create KPI, It doesn't data. I dont know whether there is any rules or comment that cannot use in service KPI

Joycetran · ‎02-03-2020

I need to create a KPI in service. This KPI is the percent between error and session. Error is count from index a, session is from index b, I need to join an create field as percent; index=a | eval time_hour = strftime(_time, "%D-%H")|stats count as error| join time_hour [search index=b eventType="use" | eval time_hour = strftime(_time, "%D-%H") | stats count AS sessions ]|eval percent=error/session *100 It does not show the data in ITSI service. What should I change

Joycetran · ‎08-15-2019

I never use Foreach before. thank you for giving this query. It works

Joycetran · ‎08-14-2019

I have the table: _time Ip_1 Ip_2 Ip_3 a 36 40 31 b 37 39 21 I want to take the percentage of each IP instead count, like: a 0.33 0.37 0.28 The table above From the query: base search | | stats dc(sid) AS distinct_search_count by provenance, mode, app, type, user, host, _time | stats sum(distinct_search_count) as total_distinct_search_count by provenance, mode, app, type, user, host, _time How can I add the percentage in the query? | timechart minspan=10s partial=false Max(total_distinct_search_count) as search_count by host

Joycetran · ‎08-13-2019

Thank you. It works.

Joycetran · ‎08-13-2019

I have the field count number and %, How can I set the query to run?

Joycetran · ‎08-07-2019

This is from Setting to set up. However, can I run a query to check as % for ip or host from index=_internal?

Joycetran · ‎08-07-2019

I want to create the dashboard for Splunk Health, one of the KPI is "search concurrent %" and " skipped search ratio %". Does anyone have a search for this? Thank you,

Joycetran · ‎08-01-2019

create the field "DM Call errors #" , then count this number. I tried to use case, but I dont have the field as title to match

Posts	9
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-12-2019

Online Status	Offline
Date Last Visited	‎04-26-2022 12:01 PM

ITSI KPI : Can I create query using join from two ...

Calculate % of each field as ratio?

How can I have the query when the field have the %...

Search for "search concurrent %" and "skipped sear...

i want to create the field of error :

Re: ITSI KPI : Can I create query using join from ...

ITSI KPI : Can I create query using join from two ...

Re: Calculate % of each field as ratio?

Calculate % of each field as ratio?

Re: How can I have the query when the field have t...

How can I have the query when the field have the %...

Re: Search for "search concurrent %" and "skipped ...

Search for "search concurrent %" and "skipped sear...

i want to create the field of error :